http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9083718 By Brian Fonseca May 7, 2008 Computerworld Researchers who extracted data from a hard drive onboard the ill-fated space shuttle Columbia say the device was so thoroughly damaged in the shuttle's fiery crash that it just looked like a cracked "hunk of metal" when it appeared at their door six months later. Data recovery specialists at Kroll Ontrack Inc. painstakingly retrieved 99% of the information stored on the charred 400MB Seagate hard drive's 2.5-in. platters over a two day period after the device was discovered six months after the 2003 shuttle crash. The device was found in a dried up lake bed along the shuttle's debris area. The successful retrieval of the data was disclosed in the April, 2008, issue of the Physical Review E journal, which published data from tests performed by the shuttle astronauts on the critical viscosity of xenon gas, according to published reports. The results of the tests were stored on the disk and retrieved by Kroll. The Columbia disintegrated upon re-entry into the Earth's atmosphere on Feb. 1, 2003, killing all seven crew members and scattering debris across Texas and Louisiana. Investigators determined that a piece of foam that became dislodged after launch damaged the ship's thermal protection system, leading to an uncontrolled buildup of heat, which destroyed the spacecraft. At the time of the accident, the shuttle was returning from a 16-day mission to conduct a variety of atmospheric scientific experiments. One of those tests was an experiment for the National Institute of Standards and Technology to determine how xenon gas flows in a zero gravity environment. Information about that test was discovered intact on the damaged drive, said Jon Edwards, a senior clean room engineer at Kroll. Edwards said the circuit board on the bottom of the drive was "burned almost beyond recognition" and that all of its components had fallen off. Every piece of plastic on the model ST9385AG hard drive melted, he noted, and all the electronic chips inside had burned and come loose. Edwards said the Seagate hard drive -- which was about eight years old in 2003 -- featured much greater fault tolerance and durability than current hard drives of similar capacity. Two other hard drives aboard the Columbia were so severely damaged that it was impossible to extract any usable data, he added. Before recovery could begin, a great deal of dirt and other debris had to be cleaned from the storage device. A rubber seal at the top of the hard drive was completely burned off enabling dirt and charred elements to enter the casing. Everything but the drive's platters were virtually unusable, remarked Edwards "The heads were bent and they were touching where they shouldn't have, so we had to carefully cut and bend metal away from the platters to get them out without causing more damage," said Edwards. Once cleaned, the platters were placed into a spare drive and carefully aligned with a new motor. Because the original circuit board was destroyed, Kroll had to use trial and error to determine which firmware was needed for the device. Although damage to the drive worsened once the team got it up and running, the data recovery specialists retrieved 99% of the drive's DOS-formatted contents. "It was only a couple hundred megabytes of data, which isn't much by today's terms, but the data [the drive] contained was very valuable," noted Edwards. _______________________________________________ Attend Black Hat USA, August 2-7 in Las Vegas, the world's premier technical event for ICT security experts. Featuring 40 hands-on training courses and 80 Briefings presentations with lots of new content and new tools. Network with 4,000 delegates from 50 nations. Visit product displays by 30 top sponsors in a relaxed setting. http://www.blackhat.com
This archive was generated by hypermail 2.1.3 : Fri May 09 2008 - 06:15:41 PDT